Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 15:39
Behavioral task
behavioral1
Sample
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe
Resource
win10v2004-20220414-en
General
-
Target
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe
-
Size
1.1MB
-
MD5
0efaae568a2ed3caf0c5515042d15f7b
-
SHA1
e64669c03a8887ee98918274735a90a15455e323
-
SHA256
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd
-
SHA512
85f7224b6a282309c95968636f974ccf21d7d7bf6a6bc72f2c472f3bcf2f3fe7359f7f2b336e8cff6e85db0db5c067e45b6a637fd18c8d4ddc3e878d1b2e33de
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exepid process 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exedescription pid process Token: SeIncreaseQuotaPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeSecurityPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeTakeOwnershipPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeLoadDriverPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeSystemProfilePrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeSystemtimePrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeProfSingleProcessPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeIncBasePriorityPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeCreatePagefilePrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeBackupPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeRestorePrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeShutdownPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeDebugPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeSystemEnvironmentPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeChangeNotifyPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeRemoteShutdownPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeUndockPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeManageVolumePrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeImpersonatePrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: SeCreateGlobalPrivilege 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: 33 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: 34 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe Token: 35 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exepid process 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.execmd.execmd.exedescription pid process target process PID 1984 wrote to memory of 1084 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe cmd.exe PID 1984 wrote to memory of 1084 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe cmd.exe PID 1984 wrote to memory of 1084 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe cmd.exe PID 1984 wrote to memory of 1084 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe cmd.exe PID 1984 wrote to memory of 1744 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe cmd.exe PID 1984 wrote to memory of 1744 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe cmd.exe PID 1984 wrote to memory of 1744 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe cmd.exe PID 1984 wrote to memory of 1744 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe cmd.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1984 wrote to memory of 2032 1984 9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe notepad.exe PID 1744 wrote to memory of 2040 1744 cmd.exe attrib.exe PID 1744 wrote to memory of 2040 1744 cmd.exe attrib.exe PID 1744 wrote to memory of 2040 1744 cmd.exe attrib.exe PID 1744 wrote to memory of 2040 1744 cmd.exe attrib.exe PID 1084 wrote to memory of 980 1084 cmd.exe attrib.exe PID 1084 wrote to memory of 980 1084 cmd.exe attrib.exe PID 1084 wrote to memory of 980 1084 cmd.exe attrib.exe PID 1084 wrote to memory of 980 1084 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 980 attrib.exe 2040 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe"C:\Users\Admin\AppData\Local\Temp\9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe"1⤵
- Modifies firewall policy service
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\9512809ee16fe65b495b07482af36e84f4b7b3bf78988e3d215b222e0aeab4fd.exe" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/980-60-0x0000000000000000-mapping.dmp
-
memory/1084-55-0x0000000000000000-mapping.dmp
-
memory/1744-56-0x0000000000000000-mapping.dmp
-
memory/1984-54-0x00000000753C1000-0x00000000753C3000-memory.dmpFilesize
8KB
-
memory/2032-57-0x0000000000000000-mapping.dmp
-
memory/2040-59-0x0000000000000000-mapping.dmp